CVE-2026-118377

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

State: Published
Severity: 8.7 High
Published: Oct 28, 2026
Updated: Oct 28, 2026
Reserved: Oct 28, 2026

Description

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	VulnCheck

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
posmewebstudio	2.0.0 and earlierAffected

References

https://github.com/mewebstudio/pos/pull/305patchissue-tracking
https://github.com/mewebstudio/pos/commit/7c59d42bc49483c7c54999d757cb67055d9f732apatch
https://github.com/mewebstudio/pos/issues/306issue-tracking
https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/PayForPos.php#L135-L150technical-description
https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/InterPos.php#L134-L149technical-description
https://github.com/mewebstudio/posproduct
VulnCheck Advisory: mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacksthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.